Selfrando Technique Mitigates Attacks Unmasking Tor Users

The FBI’s apparent capability to unmask users of the Tor Network has caused hand-wringing among those concerned with privacy and civil liberties, many of whom are busy trying to win legal battles to get law enforcement to confess as to how they’re doing it. A team of academics and researchers,...

Dept. of Justice Makes Plea for Mass Surveillance, Hacking

The Department of Justice is countering a growing chorus of privacy advocates who are against a rule change that will greatly expand law enforcement’s ability to hack into computers located around the world. In a blog post to the DoJ website late Monday, Assistant Attorney General Leslie Caldwell...

Regsvr32.exe (.sct) Application Whitelisting Bypass Server

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Regsvr32.exe .sct Application Whitelisting Bypass Server', 'Description' = %q This module simplifies the Regsvr32.exe Application Whitelisting...

Wordpress Levo-Slideshow 2.3 - Arbitrary File Upload

Document Title: =============== Wordpress Levo-Slideshow 2.3 - Arbitrary File Upload References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1854 Release Date: ============= 2016-06-07 Vulnerability Laboratory ID VL-ID: ==================================== 1854...

Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability

Document Title: =============== Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1855 Release Date: ============= 2016-06-05 Vulnerability Laboratory ID VL-ID: ====================================...

Mapbox (API) - Filter Bypass & Persistent Vulnerability

Document Title: =============== Mapbox API - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1787 ID: 119802 Release Date: ============= 2016-06-05 Vulnerability Laboratory ID VL-ID:...

IBM Cognos 11.0 Content Spoofing

/ Content Spoofing Vulnerability in IBM Cognos Analytics Applications Advisory 5190 Patch Release - 30 May 2016 Public Release - 03 June 2016 CVE-2016-0398 The IBM Security Bulletins associated with this CVE have been published at the following URLs: IBM Cognos Analytics 11.0...

Judge Tosses Evidence Gathered by FBI's Tor Exploit

The FBI’s refusal to share details about a network investigative technique it used to gather evidence against a Vancouver teacher charged with possession of child pornography has forced a federal judge’s hand to exclude the evidence from trial. The NIT used by the FBI to hack the Playpen website ...

Microsoft Warns of Sneaky New Macro Trick

Microsoft is warning of an innovative new technique attackers are using to sneak macro malware past virus detection engines and add to the already huge uptick in reported macro attacks. According to researchers at Microsoft’s Malware Protection Center, they stumbled upon the macro technique in a...

Motion Filed Asking FBI To Disclose Tor Browser Zero Day

Mozilla on Wednesday filed a motion with the U.S. District Court in Tacoma, Wa., asking the government to disclose a vulnerability it exploited in the Tor Browser and Firefox. The FBI used the zero-day to hack a child pornography site and de-anonymize users visiting the site using the Tor Browser...

NetCommWireless HSPA 3G10WVE Wireless Router - Multiple Vulnerabilities

Title: ==== NetCommWireless HSPA 3G10WVE Wireless Router – Multiple vulnerabilities Credit: ====== Name: Bhadresh Patel Company/affiliation: HelpAG Website: www.helpag.com CVE: ===== CVE-2015-6023, CVE-2015-6024 Date: ==== 03-05-2016 dd/mm/yyyy Vendor: ====== NetComm Wireless is a leading develop...

Craig Wright Will Move Satoshi Nakamoto's Bitcoin to Prove His Claim

Yesterday, BBC broke a story allegedly revealing Craig Wright as the original creator of Bitcoin digital currency Satoshi Nakamoto. However, the highly skeptical cryptographic community is definitely not yet convinced with the technical proofs Wright has yet provided to the media outlets and on h...

Django CMS 3.2.3 Cross Site Scripting

Document Title: =============== Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1820 Release Date: ============= 2016-04-19 Vulnerability Laboratory ID VL-ID: ==================================...

Hudl Technique - AWS Credentials, Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Hudl Technique published at the 'play' market has multiple vulnerabilities...

Just One? No, FBI to Unlock More iPhones with its Secret Technique

The Federal Bureau of Investigation FBI worked with Israeli mobile forensic firm Cellebrite to unlock iPhone used in the San Bernardino shooting last year, confirmed by multiple sources familiar with the matter. The United States Department of Justice DoJ said on Tuesday that the FBI successfully...

Cades (2016Q1) - (id) Multiple SQL Injection Vulnerabilities

Document Title: =============== Cades 2016Q1 - id Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1804 Release Date: ============= 2016-03-29 Vulnerability Laboratory ID VL-ID: ====================================...

Cloud Metadata URL List

Landed the SSRF Cloud Metadata technique in a few different scenarios recently. If you havent seen the talk BHUSA 2014 - Bringing a Machete to the Amazon I recommend it. To make life a little easier created a living URL list for Metadata broken down by cloud. There are a few more than he discusse...

Attention Turns to FBI's 'Outside Party'

The FBI’s motion for a continuance in its case against Apple has opened a new avenue in this debate as to the identity and means by which the mystery “outside party” could unlock terrorist Syed Farook’s iPhone. Late yesterday afternoon, the FBI filed a motion to vacate a hearing scheduled for tod...

AppLocker - Execution Prevention Bypass (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit4 'AppLocker Execution Prevention Bypass', 'Description' = %q This module will generate a .NET service executable on the target and utilise InstallUtil to...

eFront Learning CMS 3.6.15.6 Cross Site Scripting

Document Title: =============== eFront Learning 3.6.15.6 CMS - Forum Persistent Title Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1761 Release Date: ============= 2016-02-23 Vulnerability Laboratory ID VL-ID:...